Tag Info

Hot answers tagged

31

There is one theoretical way of determining the DNS resolver of your clients, but it's quite advanced and I don't know any off-the-shelf software that will do that for you. You'll for sure have to run a authoritative DNS server for that in addition to your nginx. In case the HTTP Host header is incorrect, serve an error-document and include a request to a ...


13

These are academic distinctions. In the real world, you will find some combination of all of these concepts going by different terms. In some organizations, a DMZ has a separate ISP network connection and has no access to internal resources. In other organizations, there are domain-joined machines in the DMZ that can communicate to a restricted set of ...


8

As @ChristopherPerrin said, it's the background noise of the internet. Scripts and bots are constantly scanning the internet, doing the equivalent of jiggling door handles looking for ones that are unlocked or poorly locked. I do however disagree that there is nothing you can do about it. Use those logs to block them at the firewall level. On linux I use ...


8

Any network segment that you don't fully control can be considered as a public network, so if you would encrypt traffic over a regular public network, do it for your case as well. NB: With full control I mean that you have full and sole control over any network devices that are part of the connection, so a port on e.g. a router or switch you don't own ...


8

How would this be setup connection wise without forcing all traffic through the domain controller? With site to site VPNs. You'd set up your cloud assets as a site, and then establish a site-to-site VPN between your cloud site and each of your physical sites. An alternate option, that Microsoft uses, but is generally ill-advised (unless you really, ...


7

Depends on what you're comfortable doing; when starting to "professionalize" our office network for a similarly sized business, I set up a pfSense Firewall behind our modem, and assigned it routing tasks for the office. All you need is a machine to dedicate with a few NICs and you're on your way. It's pretty well documented online, and I haven't had an ...


7

I don't think I've recently heard of an extranet outside of textbooks and class rooms. A DMZ is a common networking topology with a network segment that is segregated by firewalls from the internal network and untrusted external networks (aka the internet). In contrast the Extranet, if it is actually included in the network design, implies somewhat that ...


6

I've heard the great firewall used to redirect "blocked" traffic to a handful of phony IPs, but this was causing their blocks to be easily spotted (I'm not sure if it allowed easy subversion). In any case the administrators have started redirecting to random IPs. This has led to some Chinese users getting porn, instead of facebook or vpns, apparently. I ...


5

OpenVPN over TLS Your VPN is using TCP as a transport protocol. The stunnel instance is used to encapsulate the content of the TCP stream in TLS/TCP. You get this protocol stack: [IP ]<------------------------>[IP ] [OpenVPN]<------------------------>[OpenVPN] [TLS ]<~~~~~>[TLS] [TCP ]<->[TCP ...


5

I think it's actually more debated than you make it appear. There is an admittedly old, related Linux FAQ: http://www.tldp.org/HOWTO/VPN-HOWTO/ I've used a PPP-over-ssh-over-ADSL for more than 12 years, and it never failed me, so from my experience I'd dare to say that the doomsayers probably largely exaggerate. TCP over TCP is probably a bad idea with RTC ...


5

Network browsing across VPNs has always been problematic in my experience. If I were you I'd use a WINS server to get browsing to work (in an even remotely reliable manner). Other methods may well work, but deploying WINS is pretty straightforward and easy and, in my experience, has done the job.


5

Reverse DNS points an IP to a domain name. An ISP/Hosting company should own the IP range, and it should be no problem at all for them to create a reverse DNS entry for your IP, unless it's not just your IP (you're on shared hosting). Should that be the case, you are not going to get anywhere. Your ISP/Hosting probably can get you your own individual IP, ...


5

CHAP requires that plaintext password be accessible to the authentication server. Active Directory doesn't store plaintext passwords by default, so CHAP won't work. It would appear that you can modify the VPN server configuration file (com.apple.RemoteAccessServers.plist) to use the MS-CHAPv2 authentication protocol. Given the weakness of the protocol I ...


5

According to Technet http://blogs.technet.com/b/stdqry/archive/2011/12/15/dns-clients-and-timeouts-part-2.aspx later queries are done to multiple DNS servers in parallel. And most people have only one network connection and a fast broadband connection and should normally expect a DNS response within 1s. So I have set my DNSQueryTimeouts to 1 1 1 10 10 0 so ...


4

Setting up a VPN can be pretty easy, many routers have some built-in VPN functionality already. VPN is a broad topic and we don't know what your needs and constraints are, because you didn't tell us. You should probably hire a consultant to help you get it set up and find out what your needs and constraints are; this shouldn't be a service that you pay for ...


4

With a Cisco AnyConnect VPN there is an option on the client side to allow this IF the VPN admin is allowing split-tunneling. You can see the option here: As far as on the firewall itself, if you are the VPN/firewall admin (I'm guessing you aren't) then the setting is similar to this here:


4

Yes, UDP over a VPN is possible, but no, that wouldn't change a thing. Although the underlying transport may be reliable, the UDP has been designed not to retransmit lost packets. If you really have a problem with packetloss, either switch to TCP for transport, fix it by making the application send UDP packets slower, or increase the bandwidth on the path ...


4

Use a dynamic DNS service. Get a hostname for each site. configure VPN connections to use hostname for each connection instead of the sites IP address (Since you said its dynamic and subject to change) The dynamic DNS service should come with an application that monitors for an IP address change, and updates the hostname record automatically.


4

yes you can do this with bind views: http://www.zytrax.com/books/dns/ch7/view.html basically, you define each view as a subnet, and then each view maintains its own zone file. depending on the source ip/subnet of the dns query, you will get a different "view". this is common for name servers to use in an "internal"/"external" views, so as dns ...


4

How can I find out what DNS server those customers are using ? Contact Chinanet and ask? Seriously, DNS is configurable on the client side. Most people get DNS settings via DHCP, but OpenDNS and Google's DNS offering wouldn't have a business model if you couldn't change them. Is there anyway to determine if an HTTP request is coming from a VPN ? ...


3

Please have a look at the following: http://msdn.microsoft.com/en-us/library/azure/jj156075.aspx According to the documentation, assuming all of your network information is correct, you should disable Perfect Forward Secrecy if you are using static routing.


3

You have a number of options: Run the SSH server on port 80 or 443. Run a tunnel on the SSH server to listen on port 443 or 80 and forward it to 22. Run a VPN on port 80/443. Essentially, something on the server you're trying to connect to needs to be listening on port 443/80 in order for you to connect to it. The other solution is to talk to the ...


3

As far as I'm aware, this is simply not possible within an Amazon VPC, as they use DHCP for all of their IP assignments within a VPC subnet, static IP addresses are assigned by using Elastic Network Interfaces, which work in the same way as a DHCP reservation. Amazon Support will be able to confirm this though, so I'd suggest you contact them. Your ...


3

That's one of a pair of routes that certain VPN software sets when you tell it to redirect all of your traffic through the VPN. The other route is: 0.0.0.0/1 via 10.144.1.8 dev ppp0 ... The reason for setting these routes, of course, is so that (almost) all of your traffic goes through the VPN link. It is done this way so as not to override the default ...


3

That's quite a unique problem to be solved. Your old solution sounded like it worked for you, so there's got to be a cheaper way continuing what you were doing. A free thing would be to replace VMWare Server with VMWare ESXi (Or Hyper-V, see below) and then import your old VMWare Server VMs to get onto a supported platform. Windows Server Datacenter ...


3

This fully depends why and where the packet loss is. Some examples: Your ISP "optimizes" the traffic and downgrades your UDP traffic. In this case a VPN would help unless the ISP downgrades also the VPN traffic. You don't have enough bandwidth to handle the traffic. In this case a VPN would not help.


3

I suspect your corporate laptop VPN has been set up and configured a mode to tunnel ALL traffic down it and not just corporate traffic. In order for you to remote desktop, you will need to have it set up in a split mode. I am unfamiliar with the Cisco VPN but, for example on Sonicwall SRA devices the option is "Tunnel all mode". Many sysadmins setup their ...


3

It's an IPV6 issue, if you go to console and open your ppp log you will notice an IPv6 query every 3 seconds until it times out. You need to tell the ppp daemon to not try IPv6. To do this create a text file called options.txt with the following string: ipv6cp-max-configure 0 Save that file to the etc/ppp directory. You need to be root or sudo cp it via ...


3

How I "clear" the entries created? OpenVPN Stores this in the persist file. You can set this file by using the ifconfig-pool-persist option. If you don't set it then many distros will automatically add one at some logical location under var. Anyway, find your persist file, or manually specify one in your configuration. Once you know where it is, ...


3

Communications between your machine and the VPN endpoint are encrypted. That includes the VNC connection. However, once the packets reach the remote network, the VNC communications between the servers and the VPN endpoint are not encrypted. TightVNC only encrypts passwords, not traffic (as per http://www.tightvnc.com/faq.php).



Only top voted, non community-wiki answers of a minimum length are eligible